what are the password limitations? (ie number of characters minimum and maximum, allowable characters, disallowed characters - punctuation, etc.?)